Does Bandit support 'git@' URLs?

[zenzic64]

We use ssh to access git. Therefore my remote URLs are in the form of git@<addr> rather than https://<addr>. When I run pre-commit install, it succeeds without any warning, but it does not create a .pre-commit-hooks.yaml file in my repo. When I subsequently attempt to commit changes, I receive the error

...../pre-commit/repoorqlnv81/.pre-commit-hooks.yaml is not a file'

Am I missing something or does Bandit just not support this access method?

[zenzic64]

Never mind. That is not the problem. I switched to an https remote URL and still get the same error. I have no idea what I'm missing. My .pre-commit-config.yaml file looks like

repos:
-   repo: git@github......
    rev: v3.0.0
    hooks:
    -   id: bandit

What step should create the missing .pre-commit-hooks.yaml file? Should that happen during pre-commit install or during the failing git commit?

[mportesdev]

There is no bandit revision v3.0.0 - could this be the problem? The latest release is 1.7.4.

[zenzic64]

i thought rev referred to my repo's revision

be sure to update rev to point to a real git tag/revision

[zenzic64]

changing rev: to 1.7.4 results is

error: pathspec '1.7.4' did not match any file(s) known to git

[mportesdev]

This is a Git error message indicating that the tag cannot be found. That would suggest that the bandit repository has not been cloned correctly by pre-commit. Can you please share the whole contents of your .pre-commit-config.yaml? (or at least the bandit section)

[zenzic64]

that's it above

repos:
-   repo: git@github......
    rev: v3.0.0
    hooks:
    -   id: bandit

i know that the git error on the rev 1.7.4 was because I specified a missing tag. That was just in response to the suggestion that rev 3.0.0 was invalid because Bandit is not that high. The rev tag refers to my repo, not the Bandit version.

[zenzic64]

The pre-commit docs indicate

A git repo containing pre-commit plugins must contain a .pre-commit-hooks.yaml file that tells pre-commit: ...

I don't see anything in the Bandit docs that refers to the creation of this file. I'm fairly certain none of the pre-commit steps automatically generate it. I seem to have gotten around this by manually creating a file in my remote repo called .pre-commit-hooks.yaml .

-   id: bandit
    name: bandit
    entry: bandit
    language: python

Is this normally required? Should the Bandit docs be updated to include this step?

[mportesdev]

The .pre-commit-hooks.yaml is not supposed to be present/generated in your repository. It must be present in projects that you specify in your .pre-commit-config.yaml file. pre-commit will then clone these projects using git, read their respective .pre-commit-hooks.yaml files and run the hooks against your commits.

[zenzic64]

I think I finally understand. The repo tag should refer to Bandit, not my repo. I'm an idiot. Let me try that. Thanks!